Java Security Lead — Pen Tests & Secure Coding (Hybrid Albany)

Cybersecurity Jobs; City of Albany (NY); Hybrid; USD 76,000 - 83,000; Full time

Job summary

sdna global in Albany, NY is seeking a Java application security lead to strengthen products through real-world testing, remediation guidance, and incident support. This hybrid role combines hands-on security work with secure development practices.

You will partner with development and testing teams, perform penetration testing and vulnerability assessments on Java applications, and help embed security into the SDLC.

Qualifications

• Bachelor’s degree in Computer Science, Information Security, or a related field.
• 6+ years in a Development and/or Security (Dev Sec) role.
• Strong core Java coding experience and knowledge of Java security practices.
• Experience in Penetration Testing and/or Ethical Hacking focused on Java application security.
• Background as an engineer with Dev Sec on a large-scale public enterprise application.
• Scripting experience and strong problem-solving and analytical skills.
• Web application security principles (OWASP) and common vulnerabilities such as SQL injection and XSS.
• Penetration testing tooling experience, including Burp Suite and Metasploit.
• Familiarity with Fortify on Demand (SAST and DAST tools).
• Strong understanding of cryptography and SSL/TLS.

Responsibilities

• Run penetration tests and vulnerability assessments for Java applications and supporting infrastructure.
• Find weaknesses in Java code using automated and manual techniques.
• Build and use custom exploits to validate application security and simulate attacker tactics.
• Partner with Development teams to understand application architecture and surface security gaps early.
• Work with Testing teams to integrate security checks into both manual and automation testing.
• Provide secure coding guidance, including how to fix vulnerabilities.
• Stay current on Java security threats and best practices, and help strengthen secure development processes (SDLC).
• Support security incidents tied to Java vulnerabilities, including issues aligned to current published NIST CVE.
• Document and report findings with technical details, risk assessment, and recommended solutions.
• Communicate recommendations to technical and non-technical audiences.
• Contribute to security policies covering Java development and deployment.
• Explore penetration avenues by manipulating URLs, query parameters, and application browser data.
• Validate and assess browser tokens, including cache manipulation, and evaluate production vs non-production architecture.
• Apply MITRE ATT&CK Framework familiarity in testing and validation work.

Skills

6+ years DevSec experience

Excellent communication

Scripting experience

Cryptography knowledge

Core Java knowledge

Education

Bachelor’s degree in Computer Science or Information Security

Tools

Burp Suite

Metasploit

Fortify on Demand

OWASP

Job description

sdna global in Albany, NY is seeking a Java application security lead to strengthen products through real-world testing, remediation guidance, and incident support. This hybrid role combines hands-on security work with secure development practices.

You will partner with development and testing teams, perform penetration testing and vulnerability assessments on Java applications, and help embed security into the SDLC.